


cat << EOF > $K8_CERT_HOME/etcd-ca-config.json
{
    "signing":{
        "default":{
            "expiry":"87600h"
        },   
        "profiles":{
            "etcd":{
                "expiry":"87600h",
                "usages":[
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"

                ]

            }

        }

    }


}


EOF


cat << EOF > $K8_CERT_HOME/etcd-ca-csr.json
{
    "CN":"etcd CA",
    "key":{
        "algo":"rsa",
        "size":2048
    },
    "names":[
        {
            "C":"CN",
            "L":"Wuhan",
            "ST":"Wuhan"
        }
    
    ]

}

EOF


cat << EOF > $K8_CERT_HOME/etcd-server-csr.json

{
    "CN":"etcd",
    "hosts":[
        "10.2.238.250",
        "10.2.238.240",
        "10.2.238.100"

    ],
    "key":{
        "algo":"rsa",
        "size":2048

    },
    "names":[
        {
            "C":"CN",
            "L":"Wuhan",
            "ST":"Wuhan"

        }

    ]


}


EOF


cfssl gencert -initca $K8_CERT_HOME/etcd-ca-csr.json | cfssljson -bare $K8_CERT_HOME/etcd-ca

cfssl gencert -ca=$K8_CERT_HOME/etcd-ca.pem -ca-key=$K8_CERT_HOME/etcd-ca-key.pem -config=$K8_CERT_HOME/etcd-ca-config.json -profile=etcd $K8_CERT_HOME/etcd-server-csr.json | cfssljson -bare $K8_CERT_HOME/etcd-server


cat << EOF > $K8_CERT_HOME/kube-ca-config.json
{
    "signing":{
        "default":{
            "expiry":"87600h"
        },
        "profiles":{
            "kubernetes":{
                "expiry":"87600h",
                "usages":[
                    "signing",
                    "key encipherment",
                    "server auth",
                    "client auth"
                ]
            }

        }
    }
}


EOF

cat << EOF > $K8_CERT_HOME/kube-ca-csr.json
{
    "CN":"kubernetes",
    "key":{
        "algo":"rsa",
        "size":2048
    },
    "names":[
        {
            "C":"CN",
            "L":"Wuhan",
            "ST":"Wuhan",
            "O":"k8s",
            "OU":"System"
        }   
    ]

}

EOF

cat << EOF > $K8_CERT_HOME/kube-server-csr.json
{
    "CN":"kubernetes",
    "hosts":[
        "10.2.192.167",
        "10.2.238.250",
        "10.2.238.240",
        "10.2.238.100",
        "kubernetes",
        "kubernetes.default",
        "kubernetes.default.svc",
        "kubernetes.default.svc.cluster",
        "kubernetes.default.svc.cluster.local"
    ],
    "key":{
        "algo":"rsa",
        "size":2048
    },
    "names":[
        {
            "C":"CN",
            "L":"Wuhan",
            "ST":"Wuhan",
            "O":"k8s",
            "OU":"System"

        }
    ]

}

EOF

cat << EOF > $K8_CERT_HOME/kube-proxy-csr.json
{
    "CN":"system:kube-proxy",
    "host":[],
    "key":{
        "algo":"rsa",
        "size":2048
    },
    "names":[
        {
            "C":"CN",
            "L":"Wuhan",
            "ST":"Wuhan",
            "O":"k8s",
            "OU":"System"
        }

    ]
}

EOF

cfssl gencert -initca $K8_CERT_HOME/kube-ca-csr.json | cfssljson -bare $K8_CERT_HOME/kube-ca
cfssl gencert -ca=$K8_CERT_HOME/kube-ca.pem -ca-key=$K8_CERT_HOME/kube-ca-key.pem -config=$K8_CERT_HOME/kube-ca-config.json -profile=kubernetes $K8_CERT_HOME/kube-server-csr.json | cfssljson -bare $K8_CERT_HOME/kube-server
cfssl gencert -ca=$K8_CERT_HOME/kube-ca.pem -ca-key=$K8_CERT_HOME/kube-ca-key.pem -config=$K8_CERT_HOME/kube-ca-config.json -profile=kubernetes $K8_CERT_HOME/kube-proxy-csr.json | cfssljson -bare $K8_CERT_HOME/kube-proxy
